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(U) FBI FISA QUERY GUIDANCE 


(U) The importance of compliance with the querying procedures 


(U) In order to protect privacy and civil liberties, the Foreign Intelligence Surveillance 
Act (FISA) establishes strict rules governing collection under that Act, and the implementation 
of those rules is overseen by all three branches of government, including the Foreign Intelligence 
Surveillance Court (FISC). For information obtained pursuant to FISC-authorized electronic 
surveillance, physical search, or production of business records, FISA requires that the Attorney 
General adopt, and the FISC approve, minimization procedures that govern acquisition, 
retention, and dissemination of FISA-acquired, non-publicly available U.S. person information; 
those procedures also govern the querying of raw FISA collection. Section 702 of FISA requires 
that the Attorney General adopt, and the FISC approve, stand-alone querying procedures that 
govern the querying of raw Section 702 collection. Importantly, the standard for permissible 
queries is the same, and is explained in greater detail below, despite the different sources 
for the rules governing queries of information obtained pursuant to Section 702 of FISA 
and FISC-authorized electronic surveillance, physical search, or production of business 
records. 


(U) FISA is a critical national security tool, and compliant queries of raw FISA 
collection can and should be used to retrieve foreign intelligence information or evidence of a 
crime, in appropriate circumstances. Ensuring compliance with the standard before querying raw 
FISA collection is important for several reasons. Most importantly, failure to comply with the 
query requirements could result in a violation of the FISA statute and requirements established 
by the FISC. Further, conducting a compliant query ensures that you can rely on the results of 
the query for your investigation. Finally, noncompliant queries must be reported to the FISC, 
possibly resulting in additional requirements or constraints placed on the FBI. 


(U) Accordingly, all FBI employees and individuals on detail or assigned to the FBI 
from other agencies who have access to raw FISA collection must be mindful about how to 
conduct compliant queries of raw FISA collection. Ensuring compliance with the querying 
standard will yield valid, reliable results for use in your investigation and, ultimately, ensure that 
Congress, the FISC, and the American public maintain confidence in the implementation of the 
authorities conferred by FISA. Failure to comply with querying procedures and FISA-related 
policies could jeopardize FBI’s continued authority to collect, retain, access, and use FISA 
collection to support its mission. 


(U) The Department of Justice’s National Security Division (NSD) conducts oversight of 
compliance with the querying standard, and when instances of noncompliance are identified, 
they are reported to the FISC. All FBI personnel are responsible for compliance with the query 
rules and should immediately report possible instances of noncompliance to responsible parties 
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at FBI so that these possible incidents can be reported to NSD and, if necessary, to the FISC. ! 
NSD has generated this document in order to assist FBI personnel in understanding the querying 
standard and conducting queries of raw FISA collection that comply with applicable 
requirements. NSD also has attached an appendix of illustrative examples of both compliant and 
noncompliant queries. For questions related to FISA query compliance, please consult with your 
CDC or ADC, NSCLB, or NSD. 


(U) The querying standard 


(U) The FBI FISA querying standard is different from, and more restrictive than, rules 
that govern FBI’s queries of information collected pursuant to legal authorities other than FISA. 
It is not sufficient to run a query against raw FISA collection merely for a legitimate, work- 
related purpose. Rather, each query of raw FISA collection? must be reasonably likely to 
retrieve foreign intelligence information or evidence of a crime from FISA collection. This 
querying standard applies to all queries of raw FISA collection, regardless of whether they 
include U.S. person query terms, non-U.S. person query terms, or any other query terms (such as 
keywords). The standard applies to all queries of raw FISA collection, regardless of whether 
they are conducted during an assessment, an investigation, or otherwise. 


(U) The FBI FISA querying standard has the following three components, each of which 
must be present in a compliant query. A query must: 


¢ (U) Have an authorized purpose: the person conducting the query must have the 
purpose of retrieving foreign intelligence information or evidence of a crime from 
raw FISA collection; 


e (U) Bereasonably designed: the query term must be reasonably tailored to retrieve 
foreign intelligence information or evidence of a crime without unnecessarily 
retrieving other information from raw FISA collection; and 


e (U) Bejustified: the person conducting the query must have a specific factual basis 
to believe that the query is reasonably likely to retrieve foreign intelligence 
information or evidence of a crime from raw FISA collection. 


(0) fo) (BARE Example of a compliant justification to retrieve foreign 
intelligence information| 


———— 
b3 
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Ty) 2. (SARE) The phrase “raw FISA collection” in this guidance refers to content and noncontent 
information, including metadata. 


(0 


(0) o- (S#8EY. Example of a compliant justification to 
intelligence information and evidence of a crime 


o (U) Additional guidance 1s provided below regarding querying raw FISA 
collection only for evidence of a crime. 


(U) Helpful Tip: Leveraging other authorities prior to querying raw FISA 
collection. It is important to remember that conducting a preliminary database check in non- 
FISA datasets can assist in obtaining additional information to justify a subsequent query of raw 
FISA collection. 


TSANE Conducting queries for the purpose of vetting individuals or entities to 
determine if there is derogatory information about them in FBI holdings. NSD has reported 
to the FISC multiple FISA query compliance incidents involving a common scenario, in which 
FBI personnel have conducted queries to find any derogatory information about an individual in 
FBI holdings prior to serving legal process on an individual, or approaching the individual for 
information or assistance or to become a source. In other instances, FBI personnel have 
conducted noncompliant queries after being asked by law enforcement partners whether there is 
any derogatory information in FBI holdings regarding individuals, such as a police department 
graduate or someone applying to work in a critical infrastructure job. In the examples in this 
general category of incidents, NSD has concluded that there is no specific factual basis, absent 
additional information, to believe that the query is reasonably likely to retrieve foreign 
intelligence information or evidence of a crime from raw FISA collection, and, therefore, the 
queries do not meet the justification component of the querying standard. 


(U) Querying raw FISA collection only for evidence of a crime 

(U) You may conduct queries that you believe are likely to yield both foreign 
intelligence information and evidence of a crime. When constructing a query, keep in mind 
whether you are seeking to retrieve foreign intelligence, evidence of a crime, or both. 
Because investigations regarding international terrorism, espionage, and malicious cyber activity 
by foreign powers concern both foreign intelligence and criminal activity, queries in furtherance 
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of those investigations commonly are intended to retrieve both foreign intelligence information 
and evidence of a crime. 


(U) However, there are instances when FBI personnel query raw FISA collection in 
order to retrieve only evidence of a crime. When doing so, you should ask yourself whether a 
query you intend to conduct to retrieve only evidence of a crime is likely to retrieve such 
information specifically from raw FISA collection being queried. The following guidance will 
assist you in conducting a compliant query in raw FISA collection where you are looking for 
evidence of a crime only.’ 


(0) ry [SARE FBI users must consider whether the nature of a crime and the information 
known about the identifiers being queried are reasonably likely to find evidence of 
the crime under investigation in raw FISA collection. 


{(H) o- ESH48EJ For example, queries conducted in connection with investigations related 
to crimes with a nexus to a foreign power or a target of FISA collection, or crimes 
that have a factual connection to international terrorism, espionage or foreign 
computer intrusions would, in most instances, be reasonably likely to retrieve 
evidence of a crime from raw FISA collection. 


{D}ome TSA#XE] It is possible that information known to law enforcement at the time of an 
arrest may make it reasonably likely that queries of raw FISA collection will retrieve 
evidence of crime. FBI personnel, however, must be able to articulate the 
connection between that information and each query term prior to conducting a 
query. 

{U} ° TSE] For example, you are considering arresting an individual for narcotics 
trafficking. You want to conduct a query solely to retrieve evidence of the 
individual’s involvement in narcotics trafficking activities. You have no basis to 
believe that a query of the individual’s identifiers in raw FISA collection would 
be reasonably likely to retrieve evidence of a crime. If you run this query in raw 
FISA collection based on this information, it would be noncompliant. The same 
result would exist if the query was done post-arrest. However, if the reverse were 
true and you did have a basis to believe that a query of the individual’s identifiers 
in raw FISA collection would be reasonably likely to retrieve evidence of a crime, 
perhaps based on additional information regarding the narcotics trafficker, that 
query is justified. An example of information that would render this query 
justified would include the fact that this individual was in contact with a FISA 
target. In all cases, though, care must still be taken to design a query that will not 
unnecessarily retrieve information from FISA collection other than from your 
target’s case. 


3(U) Although finding evidence of a crime is a permissible authorized purpose, this is only part 
of the assessment you need to make before running a query against raw FISA collection. 
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{U)-o- (S#48E} On the other hand, the FISC has found that queries of the names of 
victims, next-of-kin, witnesses, or even suspects identified in local law 
enforcement homicide reports would not, without more information, be 
reasonably likely to retrieve evidence of a crime from raw FISA collection. 


{I} (S#X8E) However, if other information obtained by the FBI reveals connections 
between the victims, next-of-kin, witnesses, or suspects in the homicide reports 
and a current target of FISC-authorized electronic surveillance (or selectors 
targeted for collection pursuant to Section 702), this additional information could 
make it more likely that a query of related terms in raw FISA collection would 
retrieve evidence of a crime. For example, if a user reasonably assesses, based on 
the information available to her, that the FISA target either may have been 
involved in or has knowledge of a particular homicide, a query of related terms in 
raw FISA collection would be a compliant query 


(U) Additional considerations when querying raw FISA collection only for 
evidence of a crime 


(U) As explained above, a query may seek to retrieve foreign intelligence, evidence of a 
crime, or both. A separate order must be obtained from the FISC before accessing or 
reviewing raw Section 702 content that was returned (a) from a U.S. person query 
(b) conducted solely to retrieve evidence of a crime and (c) conducted in connection with a 
predicated criminal investigation opened by the FBI that (d) does not relate to the national 
security of the United States. U.S. person queries that are otherwise compliant with the 
querying standard and are designed only to return evidence of a crime are permitted in 
connection with a predicated criminal investigation opened by the FBI that does not relate to 
national security. However, if those queries return raw Section 702 content, you must first 
obtain an order from the FISC in accordance with Section 702(f)(2) before accessing the 
content. The only exception to this order requirement is if there is a reasonable belief that such 
content could assist in mitigating or eliminating a threat to life or serious bodily harm. By 
carefully following and providing accurate responses to the prompts and questions in FBI 
systems, along with paying close attention to this guidance and your other training, you will help 
ensure that you are taking the proper steps when conducting such a query. 


In order to ensure full compliance with the requirements of Section 702(f)(2), it 
is important to be able to identify whether your query to retrieve evidence of a crime only is 
being conducted in connection with a predicated criminal investigation not related to national 
security. The phrase “in connection with a predicated criminal investigation ... that does not 
relate to the national security of the United States” includes more than queries of the subject of 
the predicated criminal investigation and can include queries of individuals who are associates of 
the subject of the criminal investigation, but who are not subjects themselves. If you have any 
concerns that your proposed query might be connected to such a predicated criminal 
investigation, we recommend you consult with NSCLB or your CDC’s office before you 
conduct the query, and it may be advisable to decide in favor of concluding that Section 
702(f)(2) applies. 


uw 


(0) ° The further removed the predicated criminal investigation is from a 
suspected crime involving a threat to national security, the greater the likelihood that 
the U.S. person query seeking to retrieve only evidence of a crime would require a 
separate order from the FISC before reviewing the Section 702 content returned by 
the query. 


(U)-e- (S#XEF If you have a question as to whether a query you are considering in 
connection with a predicated criminal investigation is only seeking evidence of a 
crime unrelated to national security, you should discuss with NSCLB or your 
CDC’s office before conducting the query. 


e (U) This statutory FISC order requirement applies to such queries run in connection 
with a predicated criminal investigation opened by the FBI, and does not apply to 
U.S. person queries run only to retrieve evidence of a crime prior to opening an 
assessment; nor does the order requirement apply to evidence-of-a-crime-only queries 
conducted in connection with a national security investigation. However, the FISC 
has imposed a separate reporting requirement applicable to all U.S. person 
evidence-of-a-crime-only queries where contents are viewed, not just those 
originating in the context of a predicated criminal investigation. The government 
must report to the FISC on a quarterly basis each instance where FBI personnel 
access raw Section 702 collection that was returned by a query using a U.S. person 
query term that was run solely to retrieve evidence of a crime unrelated to the 
national security. NSCLB receives automated alerts from the systems when a query 
requires reporting under these circumstances. Therefore, if you conduct such a query, 
it is essential that you follow the relevant system prompts to ensure that the alerts are 
generated. 


(U) Note that, in accordance with the above requirement, if you are running a 
prudential search at the request of prosecutors for a purely criminal case (e.g., a bank 
fraud case with no national security nexus), and your search would run against raw 
Section 702 collection, you must get a court order from the FISC before viewing any 
Section 702 content returned from U.S. person query terms. 


iv) TSB) Guidance regarding batch queries 


(U) “USAREY You may want to use the batch query tool in Cor its successor system) to 
conduct a batch job consisting of multiple queries. It is important to note that each and every 
identifier queried must independently satisfy the querying standard by having an 7 
authorized purpose, an appropriate design, and a proper justification. Further, as noted b7 
below, batch queries involving certain numbers of identifiers carry additional restrictions. 
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(U) Prior to conducting a batch job inl___](or its successor system) that runs against 
raw FISA collection and includes 100 or more identifiers, FBI policy requires that you obtain the >3 
approval of an FBI attorney prior to conducting the query. Your CDC/ADC and NSCLB will be Be 
able to provide you with guidance and training on how to comply with this requirement. 


{0} {S4A8E) Queries conducted in an effort to identify whether a threat to national 
security or criminal activity exists have been consistently determined to be 


noncompliant. These queries are particularly problematic when run as part of a 
batch job, ithi i i i 


{0} 


o (SNE Often, this type of compliance incident occurs during an assessment 
or without an open assessment or investigation, before the FBI has 
information or an allegation indicating the existence of a threat to national 

0) security or criminal activity. 


° TSRE) Even when there is a reasonable belief that a threat to national security or 
criminal activity exists, queries within a batch job can be noncompliant if, when 
considered individuall i i jon i i 


(8) 


bl 
b3 
b7E 


S) 


“SECREFANOFORN. 


(U) Identifying U.S. person queries of raw Section 702 collection 


{0} (SAXE) Special requirements for U.S. person queries.* To comply with the FBI 
Section 702 Querying Procedures, it is essential that when conducting queries that run against 
raw Section 702 collection, you properly identify and record whether the query contains a U.S. 
person or presumed U.S. person query term (e.g., name or other identifier). In addition, before 
you review raw Section 702 content retrieved using a U.S. person query, the querying procedures 
require that you provide a written statement of the specific factual basis for your belief that the 
query was reasonably likely to retrieve foreign intelligence information or evidence of a crime. 


{U) SSE) Reminders about identifying U.S. person query terms. Please note, a query 


uery terms — such as a single query that combines a name and] (S)ea 
and you must treat the query as a U.S. person query if any query termis b3 
a U.S. person or presumed U.S. person identifier. This rule applies to batch jobs as well — if any b7E 


of the query terms in the batch job are a U.S. person or presumed U.S. person identifier, the 
entire batch job must be treated as such when deciding to run the batch job. 


(0) SUSMAXEY Additionally, remember that an entity such as a corporation, an unincorporated 
association, or a university can be a U.S. person. 


(0) (SPXELU.S. person presumptions. For each query you run against raw Section 702 
collection, you are required to record in the system whether the query includes a U.S. person 
term (referred to in the system as USPER), presumed U.S. person term (referred to in the system 
as presumed USPER), or “other” term (e.g., non-U.S. person identifiers, system identifiers, or 
keywords). 


(0) ° (ARE) When U.S. person status is known, presumptions are not needed. If you 
know that a particular identifier that you are planning to query is a U.S. person query 
term, you must select the “USPER” query option. Conversely, if you know that a 
particular identifier that you are planning to query is not a U.S. person or presumed 
U.S. person query term, you must select the “OTHER” option. 


(0) CS448E) When U.S. person status is unknown, you must apply presumptions. In 
situations where you do not know the U.S. person status of an identifier you want to 
query, the querying procedures require you to apply certain presumptions. 


{T} © CS#XNEL A person known to be located in the United States will be presumed to be 
a US. person if that person’s status is unknown, unless the person is identified as 
an alien not admitted for permanent residence or circumstances give rise to a 
reasonable belief that the person is not a U.S. person. 


(0) 4 {SARE When used to conduct a query, “United States person query term” means a term that is 
reasonably likely to identify one or more specific United States persons. U.S. person query terms may be 
either a single item of information or information that, when combined with other information, is 
reasonably likely to identify one or more specific U.S. persons. 
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(U} = [SA&SE) For example, if you or another law enforcement entity arrest 
someone inside the United States and do not know her or his citizenship 
status, the procedures require that you presume that person to be a U.S. 
person for purposes of queries of their identifiers, unless you have other 
information to indicate that individual is not a U.S. person. 


=. [SSE In another example, if you receive a tip at your field office about 
a person located in the United States whose citizenship status is unknown 
and are conducting queries of the individual’s identifiers as part of an 
assessment or without an open assessment or investigation, you must 
record those queries as presumed U.S. person queries unless you have 
other information to indicate that the individual is not a U.S. person. 


{0} (S#8Ej A person known to be outside of the United States, or whose location is 
unknown, will be presumed to be a non-U:S. person if that person’s status is 
unknown, unless circumstances give rise to a reasonable belief that the individual 
is a U.S. person. 


(F 


OR 


(U) Based on NSD’s oversight experience, there are some common errors that 
render a query noncompliant, and examples of both compliant and noncompliant queries 
are set forth in the attached appendix for your information. After reviewing this training 
guide, if you have questions about querying raw FISA collection, please contact your 
CDC/ADC, NSCLB, or NSD. 


(U} 
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(U) FBI FISA QUERY GUIDANCE 


(U) APPENDIX 


(U) Every query must meet each element of the querying standard in order to be 
compliant, and you will be conducting queries in a wide range of investigative situations. 
The following are several examples of compliant queries. 


1. GAN®) Compliant qu 


(5) 
jb1 
bb3 
Ib7E 
(SAKE) Please note that a compliant query must still be tailored in such a manner that it 

is reasonably likely to retrieve foreign intelligence information or evidence of a crime without 

unnecessarily retrieving other information from FISA collection. Suppose in the example above, 

instead of querying the third party’s telephone number, you are querying the third party’s name. 

In that case, consider whether the third party’s name is so common that additional details such as 

a phone number, address, or other identifier can be added in order to exclude to the extent 

possible information from raw FISA collection that is not related to the third party. 

(8) 
bl 
b3 
bIE 


- (SASF) Compliant query to investigate threat of imminent attack 


0} 


5. TSANEL Batch Job Requiring a FISC Order: You want to conduct queries in raw 
Section 702 collection using U.S. person query terms (e.g., a U.S. citizen or LPR’s phone 
number or| jin connection with a predicated criminal investigation opened 


AES | 1. 
by the FBI involving gang and drug détivity. In this instance, your proposed query terms are 
(g)I some of which are used by gang members who are subjects of the is 
investigation, as well as identifiers used by individuals who are not subjects of the investigation bE 


at the time you propose to run the queries. Assume for purposes of this example that you have a 
specific factual basis to believe that evidence of drug activity may be retrieved from raw Section 
702 collection, and you seek to run queries looking only for such evidence rather than also 
seeking foreign intelligence information. While queries seeking evidence of that crime may 
meet the three-part querying standard described above, you cannot access the content of 
any raw Section 702 collection that is returned from your queries until the FBI obtains an 
order from the FISC allowing FBI to view the products. 


(SSE) As of June 2021, users must affirmatively opt-in to datasets containing raw FISA 
collection when searchingl___] When searching[___Jand opting-in to query raw FISA data, users 43 
must be cognizant of and follow the querying standard articulated in this memo. As of September 2021, 7 
users must affirmatively opt-in to datasets containing raw Section 702 collection when searchin; 
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(Th SESE Note: If you want to run a query against raw Section 702 collection solely to 

. retrieve evidence of a crime unrelated to national security (whether in connection with a 

predicated criminal investigation or in support of pre-predication investigative steps), you should ps. 
review this guidance to ensure that you are taking the appropriate steps and are appropriately 
following all prompts provided _ eS 5, also should first consider whether 
your proposed queries are reasonably likely to retrieve evidence of a crime from raw 
Section 702 collection — your queries must still meet the querying standard, in addition to 
complying with the relevant statutory or FISC-ordered requirements. 


b7E 


(0) 
(U) The following are examples of queries that do not meet the querying standard’s 
authorized purpose, design, or justification requirements. 
(U} 
(§) 
bi 
b3 
b7E 
(0) 
§)b1 
b7E 


fi 


(0) 


{0} 


0) 


3. TS#XEL Improper Batch Query for Security Purposes; 


Batch Job Improper CHS Targeting:' 


Improper Batch Job of Domestic Arrestees 


SEC. 


bTE 


bl 
b3 
bTE 


SEC. 


{U) _(SPXEL Improper Batch Job for Liaison Purposes] CSCSC~=s@d; 


b7E 


(0) 7. (SSE) Overly Broad Query: 


(U) The following are examples of how to apply the presumptions from the 
Section 702 Querying Procedures: 


Domestic Identifier 


(0) 2. (SENEY 
702 Information: (s) 
bi 
b3 
b7E 


ig) bl 
(§) 5 
b7E 


3. TSH8ET Non-U 


from Traditional FISA: 


4. (SENET Non-USPER Presumption A uery Term is Derived 


(0) 
from a FISA business records production 


(D) ‘ hen to identify a query as “OTHER” in FBI’s systems} 

(g)b2 

nb 
b7E 


oO 


